CVE-2021-21975

CVE-2021-21975 SSRF-POC - ssrf에서 인증 정보 유출까지 먼저 pd 클라이언트를 구성하세요. 이제 ./pd deploy http-new-requests 를 실행하세요. 이제 스크립트에서 pipedream http 요청예: Randomstring.m.pipedream.net을 교체하세요. 이것을 별도의 터미널에서 실행하세요 - ./pd logs new-requests | tee -a req.txt 그리고 이제 이것을 다른 터미널에서 실행하세요 - python3 CVE-2021-21975.py iplist c...

CLEANSTART-2026-BM33422 crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user

Security vulnerability affects the apache2 package. A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user...

CVE-2023-27163

CVE-2023-27163 这是 CVE-2023-27163 的一个 PoC，该漏洞是 request-baskets 中直至 v1.2.1 版本存在的一个 SSRF 漏洞。 该漏洞允许攻击者通过 /api/baskets/name 访问敏感的网络资源。 request-baskets 包含一项功能，用户可以在其中指定另一台服务器来转发请求。 这里的问题在于，用户还可以指定非预期的服务，例如网络封闭的内部应用程序。 使用方法 $ python3 CVE-2023-27163.py --help 用法: python3 CVE-2023-27163.py 参数: URL...

CVE-2021-40438

CVE-2021-40438 Apache 转发请求 CVE CVE-2021-40438：精心构造的请求 URI 路径可导致 modproxy 将请求转发到由远程用户选择的源服务器。此漏洞影响 Apache HTTP Server 2.4.48 及更早版本。 此 CVE 可用于在 DoS 攻击中伪造原始 IP。 在 app.netlas.io 上查询易受攻击的服务器： cve.basescore:8 and geo.country:"RU" and asn.organization:"Rostelecom" AND cve.name:CVE-2021-40438 示例请求： curl...

CVE-2021-40438

CVE-2021-40438 요청 uri-path는 modproxy가 요청을 원격 사용자가 선택한 원본 서버로 전달하도록 만들 수 있습니다. 이 문제는 Apache HTTP Server 2.4.48 및 이전 버전에 영향을 미칩니다. 공격자는 요청을 제작하여 이 취약점의 uri-path를 악용할 수 있으며, 이로 인해 modproxy가 요청을 공격자가 선택한 원본 서버로 전달하게 됩니다. Apache HTTP Server의 modproxy 구성 요소는 Apache HTTP Server를 위한 프록시/게이트웨이 기능을 구현하도록...

CVE-2026-77802

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77803

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

CVE-2026-77803 Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

CVE-2026-77803

Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021 , contains a front-end request desynchronization vulnerability in the proxy request forwarding component. The root cause is that the software forwards requests containing both Content-Length and Transfer-Encoding ...

EUVD-2026-92426

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

CVE-2026-77802

Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021 are vulnerable to HTTP request smuggling in the proxy request forwarding component. The issue arises because the software forwards requests with multiple conflicting Content-Length headers verbatim, while only using t...

CVE-2026-77802 HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

EUVD-2026-92425

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77802 HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

PT-2026-105987

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description HTTP request smuggling is possible in the proxy request forwarding component. This occurs when requests containing multiple Content-Length headers with...

CVE-2026-77802: Inconsistent Interpretation of HTTP Requests

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77803: Inconsistent Interpretation of HTTP Requests

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

PT-2026-105988

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description Front-end request desynchronization is possible in the proxy request forwarding component. When a request contains both Content-Length and...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...